portal[.]meisimplesreceita[.]site

PhishDestroy identifies portal.meisimplesreceita.site as an active generic phishing domain impersonating Brazil’s official tax portal ‘Meu Simples Receita’ to harvest taxpayer credentials. The domain carries no custom drainer kit; instead it mirrors the legitimate site’s login interface to trick users into surrendering CPF and password combinations. Registrant details are concealed behind GoDaddy privacy, but the infrastructure re-uses a low-cost Let’s Encrypt certificate to appear legitimate at first glance.

This domain was flagged by exactly 1 out of 95 VirusTotal security vendors as of the seed 8b9bd2 scan window. It resolves to a Microsoft Azure IP address 20.2.88.14, is sponsored by GoDaddy.com, LLC, and was created on March 31 2026. Google Safe Browsing currently lists the domain as not classified, and the cumulative blocklist count remains zero, indicating the threat is freshly deployed and largely undetected by public blocklists.

The domain remains ACTIVE and is actively serving phishing content. Immediate defensive actions include blacklisting 20.2.88.14 at perimeter devices and adding portal.meisimplesreceita.site to DNS sinkholes or browser blocklists. Despite its low VT detection, the risk level is elevated due to the brand impersonation and immediate availability to end-users. Users should treat any email or SMS referencing this domain as hostile and verify tax information only through official channels such as gov.br domains. Remaining risk is considered MODERATE until broader detection coverage is achieved.